EUVD-2026-322412

fkie_cve-2026-45715

Budibase is an open-source low-code platform. Prior to 3.38.1, the REST datasource integration (packages/server/src/integrations/rest.ts) follows HTTP redirects without re-checking the IP blacklist, allowing an authenticated Builder to access internal services (cloud metadata, databases) by redirecting through an attacker-controlled server. This vulnerability is fixed in 3.38.1.

GHSA-fgqv-jh4g-pvg2 — Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration

Affected: npm: @budibase/server

### Summary

The REST datasource integration follows HTTP redirects without re-checking the IP blacklist, allowing an authenticated Builder to access internal services (cloud metadata, databases) by redirecting through an attacker-controlled server. The same vulnerability class was already patched in automation steps (`fetchWithBlacklist` in `packages/server/src/automations/steps/utils.ts`) but the REST integration was missed.

### Details

**Vulnerable file:** `packages/server/src/integrations/rest.ts`, lines 754-778

The `_req()` method checks the request URL against the IP blacklist at line 754, then calls `fetch(url, input)` at line 778. No `redirect: "manual"` option is set, so undici's fetch defaults to `redirect: "follow"`, automatically following HTTP 301/302/307 redirects **without re-validating the redirect target against the blacklist**.

```typescript // Line 754 — blacklist check on original URL only if (await blacklist.isBlacklisted(url)) { throw new Error("URL is blocked or could not be resolved safely.") }

// Line 778 — fetch follows redirects, NO re-check on redirect target response = await fetch(url, input) ```

The automation steps already implement the correct fix in `packages/server/src/automations/steps/utils.ts` (lines 100-136) via `fetchWithBlacklist()`, which sets `redirect: "manual"` and re-checks the blacklist on every redirect hop. The REST integration does not use this safe wrapper.

Relevant prior fix commits on the automation side: - `6cfa3b…

WID-SEC-W-2026-1477 — Budibase: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Budibase ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Code auszuführen oder seine Rechte zu erweitern.

Most recent entries from all

EUVD-2026-322412

fkie_cve-2026-45715

GHSA-fgqv-jh4g-pvg2 — Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration

WID-SEC-W-2026-1477 — Budibase: Mehrere Schwachstellen